April 2022 - stunnel-users

Requests to cloud server that requires host header
by Lorne Kates 13 Nov '24

13 Nov '24

(related to Akamai message from before-- but I have better troubleshooting information). I'm tying to route traffic through stunnel to a "cloud" based-endpoint. That endpoint has a static server name-- test.authorize.net. (This is the dev sandbox for auth.net) But if you do an nslookup on test.authorize.net, you'll get back a different servername and IP, because it's so wonderfully "cloud". Stunnel apparently tries to connect to the nslookup value. The server rejects the request because it can't route it back to test.authorize.net. I've tried adding "delay = yes" and "sni = test.authorize.net", but neither work. To see this in action, a simple setup with any accept, then connect to test.authorize.net:443 in client = yes mode. This is what a valid response looks like (13 -- give me the darn merchant ID in a POST): https://test.authorize.net/gateway/transact.dll This is what you'll get if you try to use stunnel (400 invalid url) : https://23.195.204.150/gateway/transact.dll So how can I get stunnel to send the proper Request Header (host: test.authorize.net) make sure it's using http/1.1, etc?

4 3

Re: [stunnel-users] CPU 100%
by Eric Eberhard 06 Nov '24

06 Nov '24

Long ago I had a server with a bad network card. Every once in a while it would spew uncontrollable bytes onto the network. If you open a stunnel connection and it does that this could very well be the problem. If it cheap, try changing the network card. If not, you should be able to look in your firewall/router and it will tell you who is sending what bytes to whomever. See if that machine is indeed streaming the bytes in massive quantities. If not, I would suspect your stunnel is getting stuck in it's own loop. There are a million reasons this can happen (well a few less than a million) - such as maybe a bad library in the FreeBSD or a bad choice in the Makefile - such as doing threads or something in a way your O/S does not like (I use threads=fork or whatever it is, instead of actual threading). You might tinker with some of the options that make the stunnel build and try different ones. Especially if stunnel was compiled on a different version of the O/S - could be differences in bytes in things and who knows what. That is all I can suggest beyond setting the debug level to 7 (I think is highest) and then watching the log file. Eric From: stunnel-users [mailto:[email protected]] On Behalf Of Murrey, Brian J. Sent: Wednesday, October 17, 2018 10:57 AM To: stunnel-users(a)stunnel.org Subject: [stunnel-users] CPU 100% We are running stunnel 5.49 on FreeBSD 11.2 and we're running into a problem once in a while. CPU pegs at 100% when we get an stunnel connection from one of our external devices. This affects 100% of all cores and we can't even log in to console. To mitigate this temporarily, we have a script running in the background to watch when stunnel begins to spike and restarts the daemon. It doesn't happen 100% of the time, and so far I have been unable to distinguish what makes the connection do this to the CPU. Have any of you run in to this issue? Sincerely, Brian Murrey System Engineer II, IT Infrastructure _____ NOTICE: This message may contain privileged and confidential information and/or protected health information intended solely for the use of the named recipient and may be privileged or otherwise protected by law. If you are not the intended recipient of this message, you should immediately notify the sender and delete this message. Do not disseminate, reproduce, or review this message or attachments if you are not the intended recipient. The sender or others may have legal rights restricting the dissemination of the information contained in this message and, as a result, remedies against you in the event of the improper dissemination of confidential information, trade secrets, personal information or privileged communications. This message is the work of the sender and does not necessarily reflect the position, views, or policies of TriMedx LLC or its affiliates. WARNING: The integrity and security of this message cannot be guaranteed and may contain or transmit a virus or other illicit code. Neither TriMedx LLC or its affiliates accept liability for any damage attributable to viruses or illicit code transmitted through this message or an attachment.

2 1

older browsers, stunnel and privoxy
by kovacs janos 04 Mar '24

04 Mar '24

sorry to bother, im trying to make older browsers be able to display TLS 1.1 and TLS 1.2 sites. i heard stunnel cant be configured to always forward to the current site address dynamically, thats why i would use privoxy. the browser is configured to send to: 127.0.0.1 443 stunnel config has this at the end: [Tunnel_in] client = yes accept = 127.0.0.1:443 connect = 127.0.0.1:8118 verifyChain = yes CAfile = ca-certs.pem checkHost = localhost 127.0.0.1:8118 is the privoxy address. this is what stunnel writes: LOG5[main]: Configuration successful LOG5[0]: Service [Tunnel_in] accepted connection from 127.0.0.1:3261 LOG5[0]: s_connect: connected 127.0.0.1:8118 LOG5[0]: Service [Tunnel_in] connected remote server from 127.0.0.1:3262 and the browser infinitely loads, and never loads anything or leaves the page. if i remove the last 3 lines, its the same just with this line added: LOG4[main]: Service [Tunnel_in] needs authentication to prevent MITM attacks but it doesnt give an error or anything. with a configuration like: [Tunnel_out] client = no accept = 127.0.0.1:443 connect = 127.0.0.1:8118 cert = stunnel.pem this is what it gives: LOG5[3]: Service [Tunnel_out] accepted connection from 127.0.0.1:3294 LOG3[3]: SSL_accept: 1407609B: error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request LOG5[3]: Connection reset: 0 byte(s) sent to TLS, 0 byte(s) sent to socket and browser gives a server not found error immediately. im not even sure if i should use client or server configuration in a case like this, but none of them works anyway. all i would need is for my browser to get the pages decrypted, or at least in less than TLS1.1. like how on newipnow.com i can access sites with any encryption, since they are sent to the browser without encryption. the browser just gives an "unencrypted tunnel" warning, which is how i found stunnel, and which is exactly what i need, just locally.

8 41

TPM based mutual tls authentication
by Nyiri, Gabor (Nokia - HU/Budapest) 07 Nov '23

07 Nov '23

Hi, Can you help me how to configure stunnel client to use TPM for mutual TLS authentication? I want to connect with mTLS to a remote server then make this connection available for localhost without mTLS. Thanks for your help in advance! Here is my configuration so far without TPM: debug = debug output = /tmp/stunnel.log foreground = yes [mtls_client] client = yes accept = 127.0.0.1:12019 sni = server-with-mtls.example.com checkHost = server-with-mtls.example.com connect = 1.2.3.4:443 verifyChain = yes CApath = /etc/ssl/certs/ cert = client.crt key = client.key Thanks & br, Gábor Nyíri,

2 1

GMail and OAuth 2.0
by Colin Knight 12 May '22

12 May '22

I’ve received an email from Google advising that it will no longer be able to login to Gmail with older third party apps using just username/password. Minimum login security requirements for software are now OAuth 2.0 or similar. I’m using an iPhone to post this which won’t be affected but my laptop uses POP3 collection via Foxmail and Stunnel. I must have continued access to mail on my laptop so will I have to dump Gmail or does Stunnel use OAuth 2.0 (it’s not in my config file.) Advice appreciated.

2 1

Handling AUTH LOGIN for SMTP
by reaperunknown＠live.com 22 Apr '22

22 Apr '22

Hello everyone. Perhaps I'm a little new with Stunnel but, I've successfully used it to get an old EarthLink MailStation compatible with GMail SMTP and POP mail. Kind of neat. That said, I wish to use Outlook, but going through the SMTP process manually via Telnet, I've found that the SMTP requires you issue "AUTH LOGIN" command, and give the username and password in Base64. If I do this manually, I can send SMTP mail all day. However, this unit is old enough that I don't think it knows how to do anything with SMTP auth. It also looks like Outlook doesn't turn SMTP auth off for Outlook.com personal accounts. Is there any way that I've missed to have Stunnel handle the AUTH LOGIN part of the SMTP process, so that device that can't, doesn't have to? Thanks!

2 1

Force PSK Authentication
by gerhard＠ats.hacktic.nl 19 Apr '22

19 Apr '22

Hi stunnel-users, Is there a way to force PSK Authentication? Current behavior is that if the client has no PSK Authentication configured, no authentication is performed and the connection proceeds even when the server has this configured: ciphers = PSK PSKsecrets = mypsk.txt Is this expected behavior? Is there a way to enforce PSK, in other words block clients without PSK Authentication? Thanks

2 1

Windows service won't start. ""The Stunnel TLS wrapper service is marked as an interactive service."
by robert.croteau＠quest.com 15 Apr '22

15 Apr '22

Window 10 LTCS (1089): "The Stunnel TLS wrapper service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly." looks like starting with version 5.61, this above error appears in the System Event log. I've given a quick glance at the changes from 5.60 to 5.61 and there a lot of them. From the release notes, seems that windows services code might have been affected: New features for the Windows platform - Added client mode allowing authenticated users to view logs, reconfigure and terminate running stunnel services. - Added support for multiple GUI and service instances distinguised by the location of stunnel.conf. On GitHub, I also noticed that in the source code for src/ui_win_gui.c the service is created as follows: service=CreateService(scm, SERVICE_NAME, SERVICE_DISPLAY_NAME, SERVICE_ALL_ACCESS, SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS, SERVICE_AUTO_START, SERVICE_ERROR_NORMAL, service_path, NULL, NULL, TEXT("TCPIP\0"), NULL, NULL);ui_win_gui.c at around line 1622 the SERVICE_INTERACTIVE_PROCESS flag is set Is this flag necessary? I guess that would be the culprit. my reason to upgrade is because of the CVE-2022-0778 OpenSSL vulnerability anyone has a workaround for this? Microsoft has fully disabled Interactive Service Detection starting with Windows 10 Build 1803 and Windows Server 2016 and 2019. So, it looks like that that Interactive services are no longer allowed and this can't be circumvented by changing some registry setting like it seems it was possible before. thank you

3 5

issue with vendor trying to use proxy for tls
by Daniel Trickett 14 Apr '22

14 Apr '22

Hi stunnelers, We have a supplier which we are attempting punchout to ecommerce site. We use the url http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… to initiate punchout. The host local-val.dc.clic.com routes to our local host, where stunnel is listening on port 8899. Our config file contains the following below. accept = local-val.dc-clic.com:8899 connect = val.dc-clic.com:443 The application fails to connect and is trying to connect using the incorrect url. Error Code: 202 Supplier Site Does Not Respond Unable to send the Login Request XML. Supplier Login URL: http://local-val.dc-clic.com:8899/punchout/request/0fd1ef2b-d09a-441d-b161-… We use stunnel as tls proxy for various suppliers and have been encountering more issues lately. I am feeling that the long string after the request is causing an issue for stunnel, but unclear to us. Our understanding is stunnel will open the connection to https:// val.dc-clic.com:443/punchout/request/0fd1ef2b-d09a-441d-b161-5ada0e226b80. Stunnel log indicates that a connection is opened to val.dc-clic.com. Any help appreciated! Thanks and best regards Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0

stunnel log message
by Daniel Trickett 01 Apr '22

01 Apr '22

Hello all, Happy Friday! Hope I can get some clarification on this entry from the stunnel log. The below shows up in our log, our input to stunnel is SSLv3. Is that all this is referring to? TLS state (connect): SSLv3 Thanks for your reply! Best regards, Dan This message and any attachment are confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, you must not copy this message or attachment or disclose the contents to any other person. If you have received this transmission in error, please notify the sender immediately and delete the message and any attachment from your system. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not accept liability for any omissions or errors in this message which may arise as a result of E-Mail-transmission or for damages resulting from any unauthorized changes of the content of this message and any attachment thereto. Merck KGaA, Darmstadt, Germany and any of its subsidiaries do not guarantee that this message is free of viruses and does not accept liability for any damages caused by any virus transmitted therewith. Click emdgroup.com/disclaimer<https://www.emdgroup.com/en/legal-disclaimer/mail-disclaimer.html> to access the German, French, Spanish, Portuguese, Turkish, Polish and Slovak versions of this disclaimer. Please find our Privacy Statement information by clicking here: merckgroup.com/privacy-statement-countries<https://www.merckgroup.com/en/privacy-statement/privacy-statement-countries…>

1 0